Privacy Policy

    Last updated: 19 July 2026

    1. Who We Are

    Accounting Tutor AI ("we", "us", "our") operates the website accountingtutorai.com and the Accounting Tutor AI study platform (the "Service"). We are the data controllerresponsible for the personal data we collect about you when you use the Service. For any privacy question or request, contact us at support@accountingtutorai.org.

    2. Data We Collect

    2.1 Account details

    • Email address, name, and password (hashed) when you sign up directly;
    • Profile information (such as name and avatar) received from Google when you use Google Sign-In;
    • Subscription plan, trial status, and account preferences.

    2.2 Usage data

    • Pages and features accessed, chatbot questions asked, calculators run, MCQs attempted, and timestamps;
    • Approximate country location. When you sign in, we determine the country you are connecting from. Where our hosting provider supplies this directly, we use that; otherwise we send only your IP address to a third-party geolocation service (ipapi.co) to obtain a country. We store only the two-letter country code and country name against your account — we do not store your IP address. This is approximate and may be inaccurate, particularly if you use a VPN;
    • Browser type, device type, and operating system;
    • Diagnostic and error logs.

    2.3 Payment data

    • Subscription status, plan, currency, and billing history;
    • Full card numbers and bank details are handled directly by our payment processor (Stripe) and are never stored on our servers.

    2.4 Cookies and similar technologies

    We use cookies and local storage to keep you signed in, remember your preferences, and (with your consent) measure how the Service is used. See our Cookie Policy for the full list.

    3. How and Why We Use Your Data

    • To create and maintain your account and authenticate you;
    • To deliver the Service — including running the AI tutor, saving your chat history, journal entries, calculations, and MCQ progress;
    • To process payments, manage subscriptions, and prevent payment fraud;
    • To send essential service emails (account, billing, security, policy updates);
    • To improve, debug, and secure the Service;
    • To understand the geographic distribution of our users so we can prioritise content, regional pricing and support;
    • To produce aggregated, non-identifying analytics about how the Service is used;
    • To comply with legal obligations and enforce our Terms of Service.

    4. Legal Bases for Processing (GDPR)

    If you are in the UK, EU, or EEA, we rely on the following legal bases under the UK GDPR / EU GDPR:

    • Contract — to provide the Service you have signed up for (account, AI tutor, subscription, history).
    • Legitimate interests — to secure the Service, prevent fraud and abuse, debug issues, and improve our product. We have assessed that these interests are not overridden by your rights.
    • Consent — for non-essential analytics cookies (gathered via the cookie banner) and any marketing communications. You can withdraw consent at any time.
    • Legal obligation — to keep accounting records, respond to lawful requests, and comply with tax laws.

    5. Cookies and Analytics

    Strictly necessary cookies (authentication, security, consent state) are always set because the Service cannot work without them. Analytics and performance cookies are only loaded after you accept them through the cookie banner. You can change or withdraw your choice at any time — see our Cookie Policy.

    6. Third-Party Processors and Sub-Processors

    We share personal data only with vetted service providers acting as processors on our behalf:

    • Supabase — authentication, database, and file storage hosting;
    • Stripe — payment processing, billing portal, and refunds;
    • Google (OAuth) — optional sign-in;
    • AI inference provider (Anthropic Claude API) — generates AI tutor responses from your questions; API data is not used by the provider to train AI models;
    • Email delivery provider — to send transactional and account emails;
    • Analytics provider — to measure aggregate usage (only after consent);
    • ipapi.co — IP-to-country lookup. Receives only your IP address; receives no name, email or other account data;
    • IFRS Foundation — licensor of the official accounting standards content used in the Service.

    An up-to-date list of sub-processors is available on request.

    7. Data Storage, Security and International Transfers

    Data is stored on cloud infrastructure operated by our hosting and processing providers, primarily in the EU and the United States. Where personal data is transferred outside your country, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent mechanisms. We apply industry-standard security measures including encryption in transit (TLS), encryption at rest, access controls, row level security, and regular backups. No system is 100% secure, but we work continuously to protect your data.

    8. Data Retention

    • Account data — kept while your account is active. If you delete your account, your profile and associated personal data are permanently removed from our active systems and cannot be undone;
    • Chat history, calculations, and journal entries — kept while your account is active so you can revisit them; deleted when you delete the items or your account;
    • Billing records — retained for up to 7 years to comply with tax and accounting laws;
    • Diagnostic logs — retained for up to 90 days;
    • Backups — purged on a rolling 30-day cycle.

    9. Your Rights

    Depending on where you live, you have the following rights in relation to your personal data. We will respond to verified requests within the time limits required by applicable law (typically 30 days under GDPR and 45 days under CCPA).

    9.1 Rights under GDPR (UK / EU / EEA)

    • Access — request a copy of the personal data we hold about you;
    • Rectification — ask us to correct inaccurate or incomplete data;
    • Erasure — ask us to delete your data ("right to be forgotten");
    • Portability — receive your data in a machine-readable format or have it sent to another controller;
    • Restriction — ask us to limit how we process your data;
    • Objection — object to processing based on legitimate interests or for direct marketing;
    • Withdraw consent — at any time, where we rely on consent;
    • Complain — to your local data protection authority (e.g. the UK ICO).

    9.2 Rights under CCPA / CPRA (California)

    • Right to know what personal information we collect, use, and disclose;
    • Right to delete personal information we have collected;
    • Right to correct inaccurate personal information;
    • Right to opt out of any "sale" or "sharing" of personal information — we do not sell or share personal information for cross-context behavioural advertising;
    • Right to non-discrimination for exercising your rights.

    9.3 How to exercise your rights

    Email support@accountingtutorai.org from the address associated with your account, or use our Contact page. We may ask for additional information to verify your identity before acting on a request.

    10. Children's Privacy

    The Service is not directed at children under 16 (or the higher local digital-consent age). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

    11. Changes to This Policy

    We may update this Privacy Policy from time to time. Material changes will be highlighted by an in-app notice or email. The "Last updated" date at the top of this page reflects the latest revision. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

    12. Contact Us

    For privacy questions, to exercise your rights, or to raise a complaint, email support@accountingtutorai.org or use our Contact page.